b0f()
Buffer overflow 101. A straightforward stack smashing exercise — overflow the input buffer and take control of EIP/RIP. Your entry ticket…
← Back to home
Challenge
~/ARCHIVE / MEMORY MAP
Challenge
archive.
Original binary-exploitation labs, organized by collection and indexed by memory address.
TYPE ADDRESS + ENTER TO JMP15 challenges
COLLECTION // 01
FST Bootcamp
Binary-exploitation training labs created for the FST Bootcamp.
7 challengescaptchahell()
Bypass a CAPTCHA-protected service by exploiting a binary vulnerability lurking behind the verification layer. Solve the puzzle, find the…
Expertly Secured()
Our system is so secure, it's actually insulting that you're even trying to look at it. We've implemented the latest "Trust Me Bro"…
please()
Sometimes all you have to do is ask nicely... or exploit the binary's trust. Manipulate the input to satisfy conditions and trick the…
ret2shellcode()
NX is off — the stack is executable. Inject your shellcode, find the buffer address, and redirect execution straight into your payload.
ret2vault()
The vault function holds the treasure but no direct path leads there. Overflow the buffer, chain your gadgets, and return straight into…
The Fragmented Scribe()
The scribe is dying. The message is breaking. Only 100 fragments (bytes) remain. The language has been stripped of its direct commands…
COLLECTION // 02
MOJO-JOJO
Original pwn challenges authored for the MOJO-JOJO collection.
8 challengesCS 12.06 - SYSTEM 2.0()
XIIVI ONCE SAID "IINEK DIMA AL HOLILA"…
dl()
A dynamic loader exploitation challenge. Abuse the linker's resolution mechanism to hijack control flow and redirect execution to your…
HIP-HOP()
MOJO-JOJO binary-exploitation lab authored by r3t0x.
MOJO_LAB()
MOJO-JOJO binary-exploitation lab authored by r3t0x.
Oracle()
The Oracle knows all — but can you make it speak? Exploit a format string vulnerability to leak secrets from memory and gain arbitrary…
ret2libc()
Classic return-to-libc attack. The stack is non-executable, but libc is loaded and ready. Leak a libc address, calculate offsets, and…
Two Echoes - Revenge()
MOJO-JOJO binary-exploitation lab authored by r3t0x.
Warmup()
A beginner-friendly buffer overflow warmup. Smash the stack, overwrite the return address, and redirect execution to the win function. No…
0x00000000
No matching bytes.
Try another search or reset the filters.